Every time a browser asks your server for something, the server answers with a three-digit number before it sends anything else. The browser hides it when all is well and turns it into an error page when it is not. Learning to read that number is the fastest troubleshooting skill a site owner can pick up, because it tells you which half of the problem to look at.
How to see the code
In a browser, open the developer tools (F12 on most keyboards), choose the Network tab and reload the page. The first row is the page itself and its Status column shows the code. From a terminal, this prints just the headers:
curl -I https://yourdomain.com/some-pageTest in a private window. Browsers remember some answers, permanent redirects especially, and will replay an old one without asking the server again.
The families
- 2xx: it worked.
- 3xx: go somewhere else.
- 4xx: the request was wrong or not allowed. Look at the address, the permissions and the access rules.
- 5xx: the server failed while trying. Look at the error log, the scripts and the account's resource limits.
The ones you will meet
| Code | Meaning | First thing to check |
|---|---|---|
| 200 | OK. The page was served. | If the page still looks wrong, the problem is in its content, not the server. |
| 301 | Moved permanently. | Intended? Browsers cache it, so a wrong 301 lingers after you fix it. |
| 302 | Moved for now. | Common after logins and forms. Wrong choice for a page that has moved for good. |
| 304 | Not modified. | Nothing. The browser's saved copy is still current. |
| 401 | A login is required. | Password protection on the folder, or a login that failed. |
| 403 | Forbidden. | File permissions, a deny rule in .htaccess, a firewall rule, or a folder with no index page. |
| 404 | Not found. | The address: spelling, capital letters, a missing file, or a rewrite rule that is no longer there. |
| 410 | Gone on purpose. | Nothing, if you meant it. Tells search engines to drop the page. |
| 429 | Too many requests. | A rate limit. Slow down, or find the script that is hammering the site. |
| 500 | Internal server error. | The error log. Usually a bad line in .htaccess or a PHP fatal error. |
| 502 / 504 | Bad gateway / gateway timeout. | A proxy could not get an answer in time. Slow script or an overloaded server behind it. |
| 503 | Service unavailable. | Maintenance mode, or the account ran out of PHP workers. |
| 508 | Resource limit reached. | The hosting account hit its processor, memory or process cap. See Resource Usage in cPanel. |
403: the server found it and said no
Work through the causes in order of likelihood. First, permissions: files should be 644 and folders 755 (see the permissions guide). Second, a rule: look in .htaccess in that folder and in every folder above it for Require all denied or a FilesMatch block that matches the file's type. Third, a folder without an index file on a server that has listings switched off. Fourth, a firewall: if the 403 appears only when you submit a certain form, a ModSecurity rule is the likely cause and the error log names it.
404: wrong address, or the rules that make addresses work are gone
If one page is missing, check the name carefully. Linux servers treat About.html and about.html as different files. If every page except the home page returns 404 on a WordPress site, the rewrite rules in .htaccess have been lost; open Settings > Permalinks and press Save to write them back.
500: read the log, do not guess
A 500 has dozens of possible causes and the page itself tells you nothing. The error log tells you exactly which one. In cPanel open Errors (in the Metrics section) for the web server's recent messages, and look for a file named error_log in the folder of the script that failed. The error log guide explains the common lines. The two usual suspects are a typo in .htaccess, which breaks every page in that folder at once, and a PHP error after an update.
503 and 508: the account is out of capacity
Shared hosting gives each account a fixed number of PHP processes and a share of processor time. When all of them are busy, new visitors get 503 or 508 until one frees up. A burst of real traffic can cause it; so can a single slow page being hit by a crawler, or a scheduled job that overlaps itself. Check Resource Usage in cPanel for the time the limit was hit, then match that time against the access log. Page caching is the usual cure, covered in the traffic spike guide.
Codes in the 520s
These are not standard codes. They come from Cloudflare when it cannot get a proper answer from your server: 521 means the server refused the connection, 522 that it timed out, 525 and 526 that the secure connection to your server failed. In each case the thing to test is your server directly, with the proxy paused.
A two-minute routine
- Get the code, in a private window or with
curl -I. - 4xx: check the address, then permissions, then rules.
- 5xx: open the error log and read the most recent lines.
- Note the exact time. Logs are much easier to search when you know the minute.